opensuse-su-2021:0707-1
Vulnerability from csaf_opensuse
Published
2021-05-10 18:41
Modified
2021-05-10 18:41
Summary
Security update for perl-Image-ExifTool

Notes

Title of the patch
Security update for perl-Image-ExifTool
Description of the patch
This update for perl-Image-ExifTool fixes the following issues: Update to version 12.25 fixes (boo#1185547 CVE-2021-22204) * JPEG XL support is now official * Added read support for Medical Research Council (MRC) image files * Added ability to write a number of 3gp tags in video files * Added a new Sony PictureProfile value (thanks Jos Roost) * Added a new Sony LensType (thanks LibRaw) * Added a new Nikon LensID (thanks Niels Kristian Bech Jensen) * Added a new Canon LensType * Decode more GPS information from Blackvue dashcam videos * Decode a couple of new NikonSettings tags (thanks Warren Hatch) * Decode a few new RIFF tags * Improved Validate option to add minor warning if standard XMP is missing xpacket wrapper * Avoid decoding some large arrays in DNG images to improve performance unless the -m option is used * Patched bug that could give runtime warning when trying to write an empty XMP structure * Fixed decoding of ImageWidth/Height for JPEG XL images * Fixed problem were Microsoft Xtra tags couldn't be deleted version 12.24: * Added a new PhaseOne RawFormat value (thanks LibRaw) * Decode a new Sony tag (thanks Jos Roost) * Decode a few new Panasonic and FujiFilm tags (thanks LibRaw and Greybeard) * Patched security vulnerability in DjVu reader * Updated acdsee.config in distribution (thanks StarGeek) * Recognize AutoCAD DXF files * More work on experimental JUMBF read support * More work on experimental JPEG XL read/write support version 12.23: * Added support for Olympus ORI files * Added experimental read/write support for JPEG XL images * Added experimental read support for JUMBF metadata in JPEG and Jpeg2000 images * Added built-in support for parsing GPS track from Denver ACG-8050 videos with the -ee option * Added a some new Sony lenses (thanks Jos Roost and LibRaw) * Changed priority of Samsung trailer tags so the first DepthMapImage takes precedence when -a is not used * Improved identification of M4A audio files * Patched to avoid escaping ',' in 'Binary data' message when -struct is used * Removed Unknown flag from MXF VideoCodingSchemeID tag * Fixed -forcewrite=EXIF to apply to EXIF in binary header of EPS files * API Changes: + Added BlockExtract option version 12.22: * Added a few new Sony LensTypes and a new SonyModelID (thanks Jos Roost and LibRaw) * Added Extra BaseName tag * Added a new CanonModelID (thanks LibRaw) * Decode timed GPS from unlisted programs in M2TS videos with the -ee3 option * Decode more Sony rtmd tags * Decode some tags for the Sony ILME-FX3 (thanks Jos Roost) * Allow negative values to be written to XMP-aux:LensID * Recognize HEVC video program in M2TS files * Enhanced -b option so --b suppresses tags with binary data * Improved flexibility when writing GPS coordinates: + Now pulls latitude and longitude from a combined GPSCoordinates string + Recognizes the full word 'South' and 'West' to write negative coordinates * Improved warning when trying to write an integer QuickTime date/time tag and Time::Local is not available * Convert GPSSpeed from mph to km/h in timed GPS from Garmin MP4 videos version 12.21: * Added a few new iOS QuickTime tags * Decode a couple more Sony rtmd tags * Patch to avoid possible 'Use of uninitialized value' warning when attempting to write QuickTime date/time tags with an invalid value * Fixed problem writing Microsoft Xtra tags * Fixed Windows daylight savings time patch for file times that was broken in 12.19 (however directory times will not yet handle DST properly) version 12.20: * Added ability to write some Microsoft Xtra tags in MOV/MP4 videos * Added two new Canon LensType values (thanks Norbert Wasser) * Added a new Nikon LensID * Fixed problem reading FITS comments that start before column 11 version 12.19: * Added -list_dir option * Added the 'ls-l' Shortcut tag * Extract Comment and History from FITS files * Enhanced FilePermissions to include device type (similar to 'ls -l') * Changed the name of Apple ContentIdentifier tag to MediaGroupUUID (thanks Neal Krawetz) * Fixed a potential 'substr outside of string' runtime error when reading corrupted EXIF * Fixed edge case where NikonScanIFD may not be copied properly when copying MakerNotes to another file * API Changes: + Added ability to read/write System tags of directories + Enhanced GetAllGroups() to support family 7 and take optional ExifTool reference + Changed QuickTimeHandler option default to 1 version 12.18: * Added a new SonyModelID * Decode a number of Sony tags for the ILCE-1 (thanks Jos Roost) * Decode a couple of new Canon tags (thanks LibRaw) * Patched to read differently formatted UserData:Keywords as written by iPhone * Patched to tolerate out-of-order Nikon MakerNote IFD entries when obtaining tags necessary for decryption * Fixed a few possible Condition warnings for some NikonSettings tags version 12.17: * Added a new Canon FocusMode value * Added a new FujiFilm FilmMode value * Added a number of new XMP-crs tags (thanks Herb) * Decode a new H264 MDPM tag * Allow non-conforming lower-case XMP boolean 'true' and 'false' values to be written, but only when print conversion is disabled * Improved Validate option to warn about non-capitalized boolean XMP values * Improved logic for setting GPSLatitude/LongitudeRef values when writing * Changed -json and -php options so the -a option is implied even without the -g option * Avoid extracting audio/video data from AVI videos when -ee -u is used * Patched decoding of Canon ContinuousShootingSpeed for newer firmware versions of the EOS-1DXmkIII * Re-worked LensID patch of version 12.00 (github issue #51) * Fixed a few typos in newly-added NikonSettings tags (thanks Herb) * Fixed problem where group could not be specified for PNG-pHYs tags when writing version 12.16: * Extract another form of video subtitle text * Enhanced -ee option with -ee2 and -ee3 to allow parsing of the H264 video stream in MP4 files * Changed a Nikon FlashMode value * Fixed problem that caused a failed DPX test on Strawberry Perl * API Changes: + Enhanced ExtractEmbedded option version 12.15: * Added a couple of new Sony LensType values (thanks LibRaw and Jos Roost) * Added a new Nikon FlashMode value (thanks Mike) * Decode NikonSettings (thanks Warren Hatch) * Decode thermal information from DJI RJPEG images * Fixed extra newline in -echo3 and -echo4 outputs added in version 12.10 * Fixed out-of-memory problem when writing some very large PNG files under Windows version 12.14: * Added support for 2 more types of timed GPS in video files (that makes 49 different formats now supported) * Added validity check for PDF trailer dictionary Size * Added a new Pentax LensType * Extract metadata from Jpeg2000 Association box * Changed -g:XX:YY and -G:XX:YY options to show empty strings for non-existent groups * Patched to issue warning and avoid writing date/time values with a zero month or day number * Patched to avoid runtime warnings if trying to set FileName to an empty string * Fixed issue that could cause GPS test number 12 to fail on some systems * Fixed problem extracting XML as a block from Jpeg2000 images, and extract XML tags in the XML group instead of XMP - Update URL update to 12.13: * Add time zone automatically to most string-based QuickTime date/time tags when writing unless the PrintConv option is disabled * Added -i HIDDEN option to ignore files with names that start with '.' * Added a few new Nikon ShutterMode values (thanks Jan Skoda) * Added ability to write Google GCamera MicroVideo XMP tags * Decode a new Sony tag (thanks LibRaw) * Changed behaviour when writing only pseudo tags to return an error and avoid writing any other tags if writing FileName fails * Print 'X image files read' message even if only 1 file is read when at least one other file has failed the -if condition * Added ability to geotag from DJI CSV log files * Added a new CanonModelID * Added a couple of new Sony LensType values (thanks LibRaw) * Enhanced -csvDelim option to allow '\t', '\n', '\r' and '\\' * Unescape '\b' and '\f' in imported JSON values * Fixed bug introduced in 12.10 which generated a 'Not an integer' warning when attempting to shift some QuickTime date/time tags * Fixed shared-write permission problem with -@ argfile when using -stay_open and a filename containing special characters on Windows * Added -csvDelim option * Added new Canon and Olympus LensType values (thanks LibRaw) * Added a warning if ICC_Profile is deleted from an image (github issue #63) * EndDir() function for -if option now works when -fileOrder is used * Changed FileSize conversion to use binary prefixes since that is how the conversion is currently done (eg. MiB instead of MB) * Patched -csv option so columns aren't resorted when using -G option and one of the tags is missing from a file * Fixed incompatiblity with Google Photos when writing UserData:GPSCoordinates to MP4 videos * Fixed problem where the tags available in a -p format string were limited to the same as the -if[NUM] option when NUM was specified * Fixed incorrect decoding of SourceFileIndex/SourceDirectoryIndex for Ricoh models Update to 12.10 * Added -validate test for proper TIFF magic number in JPEG EXIF header * Added support for Nikon Z7 LensData version 0801 * Added a new XMP-GPano tag * Decode ColorData for the Canon EOS 1DXmkIII * Decode more tags for the Sony ILCE-7SM3 * Automatically apply QuickTimeUTC option for CR3 files * Improved decoding of XAttrMDLabel from MacOS files * Ignore time zones when writing date/time values and using the -d option * Enhanced -echo3 and -echo4 options to allow exit status to be returned * Changed -execute so the -q option no longer suppresses the '{ready}' message when a synchronization number is used * Added ability to copy CanonMakerNotes from CR3 images to other file types * Added read support for ON1 presets file (.ONP) * Added two new CanonModelID values * Added trailing '/' when writing QuickTime:GPSCoordinates * Added a number of new XMP-crs tags * Added a new Sony LensType (thanks Jos Roost) * Added a new Nikon Z lens (thanks LibRaw) * Added a new Canon LensType * Decode ColorData for Canon EOS R5/R6 * Decode a couple of new HEIF tags * Decode FirmwareVersion for Canon M50 * Improved decoding of Sony CreativeStyle tags * Improved parsing of Radiance files to recognize comments * Renamed GIF AspectRatio tag to PixelAspectRatio * Patched EndDir() feature so subdirectories are always processed when -r is used (previously, EndDir() would end processing of a directory completely) * Avoid loading GoPro module unnecessarily when reading MP4 videos from some other cameras * Fixed problem with an incorrect naming of CodecID tags in some MKV videos * Fixed verbose output to avoid 'adding' messages for existing flattened XMP tags * Added a new Sony LensType * Recognize Mac OS X xattr files * Extract ThumbnailImage from MP4 videos of more dashcam models * Improved decoding of a number of Sony tags * Fixed problem where the special -if EndDir() function didn't work properly for directories after the one in which it was initially called * Patched to read DLL files which don't have a .rsrc section * Patched to support new IGC date format when geotagging * Patched to read DLL files with an invalid size in the header * Added support for GoPro .360 videos * Added some new Canon RF and Nikkor Z lenses * Added some new Sony LensType and CreativeStyle values and decode some ILCE-7C tags * Added a number of new Olympus SceneMode values * Added a new Nikon LensID * Decode more timed metadata from Insta360 videos * Decode timed GPS from videos of more Garmin dashcam models * Decode a new GoPro video tag * Reformat time-only EventTime values when writing and prevent arbitrary strings from being written * Patched to accept backslashes in SourceFile entries for -csv option update to 12.06 * Added read support for Lyrics3 metadata (and fixed problem where APE metadata may be ignored if Lyrics3 exists) * Added a new Panasonic VideoBurstMode value * Added a new Olympus MultipleExposureMode value * Added a new Nikon LensID * Added back conversions for XMP-dwc EventTime that were removed in 12.04 with a patch to allow time-only values * Decode GIF AspectRatio * Decode Olympus FocusBracketStepSize * Extract PNG iDOT chunk in Binary format with the name AppleDataOffsets * Process PNG images which do not start with mandatory IHDR chunk * Added a new Panasonic SelfTimer value * Decode a few more DPX tags * Extract AIFF APPL tag as ApplicationData * Fixed bug writing QuickTime ItemList 'gnre' Genre values * Fixed an incorrect value for Panasonic VideoBurstResolution * Fixed problem when applying a time shift to some invalid makernote date/time values update to 12.04: * See /usr/share/doc/packages/perl-Image-ExifTool/Change update to 11.50, see Image-ExifTool-11.50.tar.gz for details Update to version 11.30: * Add a new Sony/Minolta LensType. * Decode streaming metadata from TomTom Bandit Action Cam MP4 videos. * Decode Reconyx HF2 PRO maker notes. * Decode ColorData for some new Canon models. * Enhanced -geotag feature to set AmbientTemperature if available. * Remove non-significant spaces from some DICOM values. * Fix possible ''x' outside of string' error when reading corrupted EXIF. * Fix incorrect write group for GeoTIFF tags. Update to version 11.29 * See /usr/share/doc/packages/perl-Image-ExifTool/Changes Update to version 11.27 * See /usr/share/doc/packages/perl-Image-ExifTool/Changes Update to version 11.24 * See /usr/share/doc/packages/perl-Image-ExifTool/Changes Update to version 11.11 (changes since 11.01): * See /usr/share/doc/packages/perl-Image-ExifTool/Changes Update to 11.01: * Added a new ProfileCMMType * Added a Validate warning about non-standard EXIF or XMP in PNG images * Added a new Canon LensType * Decode a couple more PanasonicRaw tags * Patched to avoid adding tags to QuickTime videos with multiple 'mdat' atoms --> avoids potential corruption of these videos! Update to 11.00: * Added read support for WTV and DVR-MS videos * Added print conversions for some ASF date/time tags * Added a new SonyModelID * Decode a new PanasonicRaw tag * Decode some new Sony RX100 VI tags * Made Padding and OffsetSchema tags 'unsafe' so they aren't copied by default
Patchnames
openSUSE-2021-707
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for perl-Image-ExifTool",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for perl-Image-ExifTool fixes the following issues:\n\nUpdate to version 12.25 fixes (boo#1185547 CVE-2021-22204)\n\n* JPEG XL support is now official\n* Added read support for Medical Research Council (MRC) image\n  files\n* Added ability to write a number of 3gp tags in video files\n* Added a new Sony PictureProfile value (thanks Jos Roost)\n* Added a new Sony LensType (thanks LibRaw)\n* Added a new Nikon LensID (thanks Niels Kristian Bech Jensen)\n* Added a new Canon LensType\n* Decode more GPS information from Blackvue dashcam videos\n* Decode a couple of new NikonSettings tags (thanks Warren\n  Hatch)\n* Decode a few new RIFF tags\n* Improved Validate option to add minor warning if standard\n  XMP is missing xpacket wrapper\n* Avoid decoding some large arrays in DNG images to improve\n  performance unless the -m option is used\n* Patched bug that could give runtime warning when trying to\n  write an empty XMP structure\n* Fixed decoding of ImageWidth/Height for JPEG XL images\n* Fixed problem were Microsoft Xtra tags couldn\u0027t be deleted\n\nversion 12.24:\n\n* Added a new PhaseOne RawFormat value (thanks LibRaw)\n* Decode a new Sony tag (thanks Jos Roost)\n* Decode a few new Panasonic and FujiFilm tags (thanks LibRaw\n  and Greybeard)\n* Patched security vulnerability in DjVu reader\n* Updated acdsee.config in distribution (thanks StarGeek)\n* Recognize AutoCAD DXF files\n* More work on experimental JUMBF read support\n* More work on experimental JPEG XL read/write support\n\nversion 12.23:\n\n* Added support for Olympus ORI files\n* Added experimental read/write support for JPEG XL images\n* Added experimental read support for JUMBF metadata in JPEG\n  and Jpeg2000 images\n* Added built-in support for parsing GPS track from Denver\n  ACG-8050 videos\n  with the -ee option\n* Added a some new Sony lenses (thanks Jos Roost and LibRaw)\n* Changed priority of Samsung trailer tags so the first\n  DepthMapImage takes\n  precedence when -a is not used\n* Improved identification of M4A audio files\n* Patched to avoid escaping \u0027,\u0027 in \u0027Binary data\u0027 message when\n  -struct is used\n* Removed Unknown flag from MXF VideoCodingSchemeID tag\n* Fixed -forcewrite=EXIF to apply to EXIF in binary header of\n  EPS files\n* API Changes:\n  + Added BlockExtract option\n\nversion 12.22:\n\n* Added a few new Sony LensTypes and a new SonyModelID (thanks\n  Jos Roost and LibRaw)\n* Added Extra BaseName tag\n* Added a new CanonModelID (thanks LibRaw)\n* Decode timed GPS from unlisted programs in M2TS videos with\n  the -ee3 option\n* Decode more Sony rtmd tags\n* Decode some tags for the Sony ILME-FX3 (thanks Jos Roost)\n* Allow negative values to be written to XMP-aux:LensID\n* Recognize HEVC video program in M2TS files\n* Enhanced -b option so --b suppresses tags with binary data\n* Improved flexibility when writing GPS coordinates:\n  + Now pulls latitude and longitude from a combined\n    GPSCoordinates string\n  + Recognizes the full word \u0027South\u0027 and \u0027West\u0027 to write\n    negative coordinates\n* Improved warning when trying to write an integer QuickTime\n  date/time tag and Time::Local is not available\n* Convert GPSSpeed from mph to km/h in timed GPS from Garmin\n  MP4 videos\n\nversion 12.21:\n\n* Added a few new iOS QuickTime tags\n* Decode a couple more Sony rtmd tags\n* Patch to avoid possible \u0027Use of uninitialized value\u0027 warning\n  when attempting to write QuickTime date/time tags with an\n  invalid value\n* Fixed problem writing Microsoft Xtra tags\n* Fixed Windows daylight savings time patch for file times\n  that was broken in 12.19 (however directory times will not\n  yet handle DST properly)\n\nversion 12.20:\n\n* Added ability to write some Microsoft Xtra tags in MOV/MP4\n  videos\n* Added two new Canon LensType values (thanks Norbert Wasser)\n* Added a new Nikon LensID\n* Fixed problem reading FITS comments that start before column\n  11\n\nversion 12.19:\n\n* Added -list_dir option\n* Added the \u0027ls-l\u0027 Shortcut tag\n* Extract Comment and History from FITS files\n* Enhanced FilePermissions to include device type (similar to\n  \u0027ls -l\u0027)\n* Changed the name of Apple ContentIdentifier tag to\n  MediaGroupUUID (thanks Neal Krawetz)\n* Fixed a potential \u0027substr outside of string\u0027 runtime error\n  when reading corrupted EXIF\n* Fixed edge case where NikonScanIFD may not be copied\n  properly when copying MakerNotes to another file\n* API Changes:\n  + Added ability to read/write System tags of directories\n  + Enhanced GetAllGroups() to support family 7 and take\n    optional ExifTool reference\n  + Changed QuickTimeHandler option default to 1\n\nversion 12.18:\n\n* Added a new SonyModelID\n* Decode a number of Sony tags for the ILCE-1 (thanks Jos\n  Roost)\n* Decode a couple of new Canon tags (thanks LibRaw)\n* Patched to read differently formatted UserData:Keywords as\n  written by iPhone\n* Patched to tolerate out-of-order Nikon MakerNote IFD entries\n  when obtaining tags necessary for decryption\n* Fixed a few possible Condition warnings for some\n  NikonSettings tags\n\nversion 12.17:\n\n* Added a new Canon FocusMode value\n* Added a new FujiFilm FilmMode value\n* Added a number of new XMP-crs tags (thanks Herb)\n* Decode a new H264 MDPM tag\n* Allow non-conforming lower-case XMP boolean \u0027true\u0027 and\n  \u0027false\u0027 values to be written, but only when print conversion\n  is disabled\n* Improved Validate option to warn about non-capitalized\n  boolean XMP values\n* Improved logic for setting GPSLatitude/LongitudeRef values\n  when writing\n* Changed -json and -php options so the -a option is implied\n  even without the -g option\n* Avoid extracting audio/video data from AVI videos when -ee\n  -u is used\n* Patched decoding of Canon ContinuousShootingSpeed for newer\n  firmware versions of the EOS-1DXmkIII\n* Re-worked LensID patch of version 12.00 (github issue #51)\n* Fixed a few typos in newly-added NikonSettings tags (thanks\n  Herb)\n* Fixed problem where group could not be specified for\n  PNG-pHYs tags when writing\nversion 12.16:\n* Extract another form of video subtitle text\n* Enhanced -ee option with -ee2 and -ee3 to allow parsing of\n  the H264 video stream in MP4 files\n* Changed a Nikon FlashMode value\n* Fixed problem that caused a failed DPX test on Strawberry\n  Perl\n* API Changes:\n  + Enhanced ExtractEmbedded option\n\nversion 12.15:\n\n* Added a couple of new Sony LensType values (thanks LibRaw\n  and Jos Roost)\n* Added a new Nikon FlashMode value (thanks Mike)\n* Decode NikonSettings (thanks Warren Hatch)\n* Decode thermal information from DJI RJPEG images\n* Fixed extra newline in -echo3 and -echo4 outputs added in\n  version 12.10\n* Fixed out-of-memory problem when writing some very large PNG\n  files under Windows\n\nversion 12.14:\n\n* Added support for 2 more types of timed GPS in video files\n  (that makes 49 different formats now supported)\n* Added validity check for PDF trailer dictionary Size\n* Added a new Pentax LensType\n* Extract metadata from Jpeg2000 Association box\n* Changed -g:XX:YY and -G:XX:YY options to show empty strings\n  for non-existent groups\n* Patched to issue warning and avoid writing date/time values\n  with a zero month or day number\n* Patched to avoid runtime warnings if trying to set FileName\n  to an empty string\n* Fixed issue that could cause GPS test number 12 to fail on\n  some systems\n* Fixed problem extracting XML as a block from Jpeg2000\n  images, and extract XML tags in the XML group instead of XMP\n- Update URL\n\nupdate to 12.13:\n\n* Add time zone automatically to most string-based QuickTime date/time tags\n  when writing unless the PrintConv option is disabled\n* Added -i HIDDEN option to ignore files with names that start with \u0027.\u0027\n* Added a few new Nikon ShutterMode values (thanks Jan Skoda)\n* Added ability to write Google GCamera MicroVideo XMP tags\n* Decode a new Sony tag (thanks LibRaw)\n* Changed behaviour when writing only pseudo tags to return an error and avoid\n  writing any other tags if writing FileName fails\n* Print \u0027X image files read\u0027 message even if only 1 file is read when at least\n  one other file has failed the -if condition\n* Added ability to geotag from DJI CSV log files\n* Added a new CanonModelID\n* Added a couple of new Sony LensType values (thanks LibRaw)\n* Enhanced -csvDelim option to allow \u0027\\t\u0027, \u0027\\n\u0027, \u0027\\r\u0027 and \u0027\\\\\u0027\n* Unescape \u0027\\b\u0027 and \u0027\\f\u0027 in imported JSON values\n* Fixed bug introduced in 12.10 which generated a \u0027Not an integer\u0027 warning\n  when attempting to shift some QuickTime date/time tags\n* Fixed shared-write permission problem with -@ argfile when using -stay_open\n  and a filename containing special characters on Windows\n* Added -csvDelim option\n* Added new Canon and Olympus LensType values (thanks LibRaw)\n* Added a warning if ICC_Profile is deleted from an image (github issue #63)\n* EndDir() function for -if option now works when -fileOrder is used\n* Changed FileSize conversion to use binary prefixes since that is how the\n  conversion is currently done (eg. MiB instead of MB)\n* Patched -csv option so columns aren\u0027t resorted when using -G option and one\n  of the tags is missing from a file\n* Fixed incompatiblity with Google Photos when writing UserData:GPSCoordinates\n  to MP4 videos\n* Fixed problem where the tags available in a -p format string were limited to\n  the same as the -if[NUM] option when NUM was specified\n* Fixed incorrect decoding of SourceFileIndex/SourceDirectoryIndex for Ricoh\n  models\n\nUpdate to 12.10\n\n* Added -validate test for proper TIFF magic number in\n  JPEG EXIF header\n* Added support for Nikon Z7 LensData version 0801\n* Added a new XMP-GPano tag\n* Decode ColorData for the Canon EOS 1DXmkIII\n* Decode more tags for the Sony ILCE-7SM3\n* Automatically apply QuickTimeUTC option for CR3 files\n* Improved decoding of XAttrMDLabel from MacOS files\n* Ignore time zones when writing date/time values and\n  using the -d option\n* Enhanced -echo3 and -echo4 options to allow exit status\n  to be returned\n* Changed -execute so the -q option no longer suppresses\n  the \u0027{ready}\u0027 message when a synchronization number is used\n* Added ability to copy CanonMakerNotes from CR3 images\n  to other file types\n* Added read support for ON1 presets file (.ONP)\n* Added two new CanonModelID values\n* Added trailing \u0027/\u0027 when writing QuickTime:GPSCoordinates\n* Added a number of new XMP-crs tags\n* Added a new Sony LensType (thanks Jos Roost)\n* Added a new Nikon Z lens (thanks LibRaw)\n* Added a new Canon LensType\n* Decode ColorData for Canon EOS R5/R6\n* Decode a couple of new HEIF tags\n* Decode FirmwareVersion for Canon M50\n* Improved decoding of Sony CreativeStyle tags\n* Improved parsing of Radiance files to recognize comments\n* Renamed GIF AspectRatio tag to PixelAspectRatio\n* Patched EndDir() feature so subdirectories are always\n  processed when -r is used (previously, EndDir() would\n  end processing of a directory completely)\n* Avoid loading GoPro module unnecessarily when reading MP4 videos\n  from some other cameras\n* Fixed problem with an incorrect naming of CodecID tags in some\n  MKV videos\n* Fixed verbose output to avoid \u0027adding\u0027 messages for\n  existing flattened XMP tags\n* Added a new Sony LensType\n* Recognize Mac OS X xattr files\n* Extract ThumbnailImage from MP4 videos of more dashcam models\n* Improved decoding of a number of Sony tags\n* Fixed problem where the special -if EndDir() function didn\u0027t\n  work properly for directories after the one in which\n  it was initially called\n* Patched to read DLL files which don\u0027t have a .rsrc section\n* Patched to support new IGC date format when geotagging\n* Patched to read DLL files with an invalid size in the header \n* Added support for GoPro .360 videos\n* Added some new Canon RF and Nikkor Z lenses\n* Added some new Sony LensType and CreativeStyle values\n  and decode some ILCE-7C tags\n* Added a number of new Olympus SceneMode values\n* Added a new Nikon LensID\n* Decode more timed metadata from Insta360 videos\n* Decode timed GPS from videos of more Garmin dashcam models\n* Decode a new GoPro video tag\n* Reformat time-only EventTime values when writing and prevent\n  arbitrary strings from being written\n* Patched to accept backslashes in SourceFile entries for -csv option\n\nupdate to 12.06\n\n* Added read support for Lyrics3 metadata (and fixed problem\n  where APE metadata may be ignored if Lyrics3 exists)\n* Added a new Panasonic VideoBurstMode value\n* Added a new Olympus MultipleExposureMode value\n* Added a new Nikon LensID\n* Added back conversions for XMP-dwc EventTime that were removed\n  in 12.04 with a patch to allow time-only values\n* Decode GIF AspectRatio\n* Decode Olympus FocusBracketStepSize\n* Extract PNG iDOT chunk in Binary format with the\n  name AppleDataOffsets\n* Process PNG images which do not start with mandatory\n  IHDR chunk\n* Added a new Panasonic SelfTimer value\n* Decode a few more DPX tags\n* Extract AIFF APPL tag as ApplicationData\n* Fixed bug writing QuickTime ItemList \u0027gnre\u0027 Genre values\n* Fixed an incorrect value for Panasonic VideoBurstResolution\n* Fixed problem when applying a time shift to some invalid\n  makernote date/time values\n\nupdate to 12.04:\n\n* See /usr/share/doc/packages/perl-Image-ExifTool/Change \n\nupdate to 11.50, see Image-ExifTool-11.50.tar.gz for details\n\nUpdate to version 11.30:\n\n* Add a new Sony/Minolta LensType.\n* Decode streaming metadata from TomTom Bandit Action Cam MP4\n  videos.\n* Decode Reconyx HF2 PRO maker notes.\n* Decode ColorData for some new Canon models.\n* Enhanced -geotag feature to set AmbientTemperature if\n  available.\n* Remove non-significant spaces from some DICOM values.\n* Fix possible \u0027\u0027x\u0027 outside of string\u0027 error when reading\n  corrupted EXIF.\n* Fix incorrect write group for GeoTIFF tags.\n\nUpdate to version 11.29\n\n* See /usr/share/doc/packages/perl-Image-ExifTool/Changes\n\nUpdate to version 11.27\n\n* See /usr/share/doc/packages/perl-Image-ExifTool/Changes\n\nUpdate to version 11.24\n\n* See /usr/share/doc/packages/perl-Image-ExifTool/Changes\n\nUpdate to version 11.11 (changes since 11.01):\n\n* See /usr/share/doc/packages/perl-Image-ExifTool/Changes\n\nUpdate to 11.01:\n\n* Added a new ProfileCMMType\n* Added a Validate warning about non-standard EXIF or XMP in\n  PNG images\n* Added a new Canon LensType\n* Decode a couple more PanasonicRaw tags\n* Patched to avoid adding tags to QuickTime videos with multiple\n  \u0027mdat\u0027 atoms --\u003e avoids potential corruption of these videos!\n\nUpdate to 11.00:\n\n* Added read support for WTV and DVR-MS videos\n* Added print conversions for some ASF date/time tags\n* Added a new SonyModelID\n* Decode a new PanasonicRaw tag\n* Decode some new Sony RX100 VI tags\n* Made Padding and OffsetSchema tags \u0027unsafe\u0027 so they\n  aren\u0027t copied by default \n\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2021-707",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_0707-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2021:0707-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SLQ4XG6SNL6OL7SHPBZLVWYCAEZGZW5X/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2021:0707-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SLQ4XG6SNL6OL7SHPBZLVWYCAEZGZW5X/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1185547",
        "url": "https://bugzilla.suse.com/1185547"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-22204 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-22204/"
      }
    ],
    "title": "Security update for perl-Image-ExifTool",
    "tracking": {
      "current_release_date": "2021-05-10T18:41:24Z",
      "generator": {
        "date": "2021-05-10T18:41:24Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2021:0707-1",
      "initial_release_date": "2021-05-10T18:41:24Z",
      "revision_history": [
        {
          "date": "2021-05-10T18:41:24Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "exiftool-12.25-bp152.4.3.1.noarch",
                "product": {
                  "name": "exiftool-12.25-bp152.4.3.1.noarch",
                  "product_id": "exiftool-12.25-bp152.4.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
                "product": {
                  "name": "perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
                  "product_id": "perl-File-RandomAccess-12.25-bp152.4.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "perl-Image-ExifTool-12.25-bp152.4.3.1.noarch",
                "product": {
                  "name": "perl-Image-ExifTool-12.25-bp152.4.3.1.noarch",
                  "product_id": "perl-Image-ExifTool-12.25-bp152.4.3.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Package Hub 15 SP1",
                "product": {
                  "name": "SUSE Package Hub 15 SP1",
                  "product_id": "SUSE Package Hub 15 SP1"
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Package Hub 15 SP2",
                "product": {
                  "name": "SUSE Package Hub 15 SP2",
                  "product_id": "SUSE Package Hub 15 SP2"
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.2",
                "product": {
                  "name": "openSUSE Leap 15.2",
                  "product_id": "openSUSE Leap 15.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "exiftool-12.25-bp152.4.3.1.noarch as component of SUSE Package Hub 15 SP1",
          "product_id": "SUSE Package Hub 15 SP1:exiftool-12.25-bp152.4.3.1.noarch"
        },
        "product_reference": "exiftool-12.25-bp152.4.3.1.noarch",
        "relates_to_product_reference": "SUSE Package Hub 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-File-RandomAccess-12.25-bp152.4.3.1.noarch as component of SUSE Package Hub 15 SP1",
          "product_id": "SUSE Package Hub 15 SP1:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch"
        },
        "product_reference": "perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
        "relates_to_product_reference": "SUSE Package Hub 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Image-ExifTool-12.25-bp152.4.3.1.noarch as component of SUSE Package Hub 15 SP1",
          "product_id": "SUSE Package Hub 15 SP1:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch"
        },
        "product_reference": "perl-Image-ExifTool-12.25-bp152.4.3.1.noarch",
        "relates_to_product_reference": "SUSE Package Hub 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "exiftool-12.25-bp152.4.3.1.noarch as component of SUSE Package Hub 15 SP2",
          "product_id": "SUSE Package Hub 15 SP2:exiftool-12.25-bp152.4.3.1.noarch"
        },
        "product_reference": "exiftool-12.25-bp152.4.3.1.noarch",
        "relates_to_product_reference": "SUSE Package Hub 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-File-RandomAccess-12.25-bp152.4.3.1.noarch as component of SUSE Package Hub 15 SP2",
          "product_id": "SUSE Package Hub 15 SP2:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch"
        },
        "product_reference": "perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
        "relates_to_product_reference": "SUSE Package Hub 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Image-ExifTool-12.25-bp152.4.3.1.noarch as component of SUSE Package Hub 15 SP2",
          "product_id": "SUSE Package Hub 15 SP2:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch"
        },
        "product_reference": "perl-Image-ExifTool-12.25-bp152.4.3.1.noarch",
        "relates_to_product_reference": "SUSE Package Hub 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "exiftool-12.25-bp152.4.3.1.noarch as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:exiftool-12.25-bp152.4.3.1.noarch"
        },
        "product_reference": "exiftool-12.25-bp152.4.3.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-File-RandomAccess-12.25-bp152.4.3.1.noarch as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch"
        },
        "product_reference": "perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Image-ExifTool-12.25-bp152.4.3.1.noarch as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch"
        },
        "product_reference": "perl-Image-ExifTool-12.25-bp152.4.3.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-22204",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-22204"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP1:exiftool-12.25-bp152.4.3.1.noarch",
          "SUSE Package Hub 15 SP1:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
          "SUSE Package Hub 15 SP1:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch",
          "SUSE Package Hub 15 SP2:exiftool-12.25-bp152.4.3.1.noarch",
          "SUSE Package Hub 15 SP2:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
          "SUSE Package Hub 15 SP2:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch",
          "openSUSE Leap 15.2:exiftool-12.25-bp152.4.3.1.noarch",
          "openSUSE Leap 15.2:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
          "openSUSE Leap 15.2:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-22204",
          "url": "https://www.suse.com/security/cve/CVE-2021-22204"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1185547 for CVE-2021-22204",
          "url": "https://bugzilla.suse.com/1185547"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP1:exiftool-12.25-bp152.4.3.1.noarch",
            "SUSE Package Hub 15 SP1:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
            "SUSE Package Hub 15 SP1:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch",
            "SUSE Package Hub 15 SP2:exiftool-12.25-bp152.4.3.1.noarch",
            "SUSE Package Hub 15 SP2:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
            "SUSE Package Hub 15 SP2:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch",
            "openSUSE Leap 15.2:exiftool-12.25-bp152.4.3.1.noarch",
            "openSUSE Leap 15.2:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
            "openSUSE Leap 15.2:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP1:exiftool-12.25-bp152.4.3.1.noarch",
            "SUSE Package Hub 15 SP1:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
            "SUSE Package Hub 15 SP1:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch",
            "SUSE Package Hub 15 SP2:exiftool-12.25-bp152.4.3.1.noarch",
            "SUSE Package Hub 15 SP2:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
            "SUSE Package Hub 15 SP2:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch",
            "openSUSE Leap 15.2:exiftool-12.25-bp152.4.3.1.noarch",
            "openSUSE Leap 15.2:perl-File-RandomAccess-12.25-bp152.4.3.1.noarch",
            "openSUSE Leap 15.2:perl-Image-ExifTool-12.25-bp152.4.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-05-10T18:41:24Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-22204"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.